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This application has been examined 



Responsive to communication filed on_ 



□ 



This action Is made final. 



A shortened statutory period Xtx response to tfils action Is sat to expire _ 



_ month{8), . 



_ days from the date of this letter. 



Fdlure to respond within the period for response will cause the application to twcome abandoned. 35 U.S.C. 133 
Put I THE EOLLOWINO ATTACHHENr(8) ARE PART OF THIS ACTION: 



1 . BNotice of References Cited by Examiner, PTO-e92. 

3. □ Notice of Art Cited by AppllcanL PTO-1 449. 

5. n Irtformation on How to Effect Drawing Changes. PTO-1474. 



2. n Notice of Draftsman's Patem Drawing Review, PTO-94e. 
4. □ Notice otlnfomialP^rrt AppllcsUlflo. PTO-152. 



Pari II ;BUMMARY OF ACTION 

I Claims I — B 



1. [^Oalrr 



_ are pending in the application. 



Ml 



Of the ^Mve. claims 

2. □ Claims 

4. ScLlms < i^-y J?-^a4^/ are rejected. 

5. L:J Claims 2^^^^" I ^ ^ /^^ objected to 



are withdrawn from consideration. 

have been cancoiled. 

are allowed. 



_ are subject to restriction or election requirement. 



lQcw 

6. □ Claim3_ 

7. [HtWs application has been filed with Informal drawings under 37 C.F.R. i .85 which are acceptable for examination purposes. 

8. H^Formai drawings are required In response to this Office action. 

9. D The corrected or substitute drawings have been received on _ 



Under 37 C.F.R. 1.84 these drawings 



are □ acceptable; □ not acceptable (see explanation or Notice of Draftsman's Potent Drawing Review. PTO-948}. 

. has (have) been □ approved by the 



10, □ The proposed addltlorwl or substitute 8heet(s) of drawings, filed 
examiner; □ disapproved by the examiner (see explanation). 

11. 0 The proposed drawing conwtlon, filed 



, has t)een □ approved; □ disapproved (see explanation). 



12. n Adinowledgement Is made of the dalm for priority under 35 U.S.C. 119. The certitled copy has □ been received D not been received 

□ been filed in parent appHcaWon, serial no. : filed on . 

13. ED Since this application apppears to be In condition for allowance except for formal matters, prosecution as to the merits Is closed in 

accordance with the practice under Ex parte Quayle, 1935 CD. 11 ; 453 O.Q. 21 3. 

14. □ Other 



---FT(N.-326(Rw.2rB3) 
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DETAILED ACTION 



Drawings 



1 . This application has been filed with informal drawings which are acceptable for 
examination purposes only. Formal drawings will be required when the application is allowed. 
See PTO Substitute Form-948 attached. 



2. The use of the trademarks UNIX, Windows or Windows NT, Macintosh, Motorola, Intel 
Pentium have been noted in this application, see for example pages 7 and 10. They should be 
capitalized wherever they appear and be accompanied by the generic terminology. 

Although the use of trademarks is permissible in patent applications, the proprietary 
nature of the marks should be respected and every effort made to prevent their use in any manner 
which might adversely affect their validity as trademarks. 

Claim Objections 

3. Claims 7, 15, 19, and 23 are objected to because of the following informalities: 

As per claims 7 and 19, line 2, the preposition "in" seems inappropriate in the sentence. 
Please replace this preposition by the indefinite article "a" or provide an explanation. 



Specification 
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As per claim 15 line 2, the word "uuencoded" is a typo; it should be corrected to read 
"unencoded". 

As per claim 23, line 2, the preposition "in" after the word "using" should be deleted. 
Appropriate correction is required. 



4. Claims 2-4, 9-12, 16, 18, 19, 21 and 23 are objected to as being dependent upon a 
rejected base claim, but would be allowable if rewritten in mdependent form mcluding all of the 
limitations of the base claim and any intervening claims. 

As per claims 2-4, 11, and 12, the prior arts do not teach, singly or in combination, that 
the server is a proxy server nor do they teach a FTP or SMTP proxy server to handle evaluation 
and transfer of data files. The prior arts also fail to teach a daemon for transferring data from the 
proxy server wherein the daemon is an FTP or SMTP daemon. 

As per claims 9 and 10, The prior arts fail to teach, singly or in combination, the step of 
determining whether the data is of a type and transmitting the data from the server to the 
destination without performing the steps of scanning, determining, performing and sending, if the 
data is not of a type that is likely to contain a virus. 

As per claim 16, the prior arts fail to teach, singly or in combination, that the server 
includes a SMTP proxy server and a SMTP daemon. 



Allowable Subject Matter 
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As per claims 18, 19, and 21, the prior arts fail to teach, singly or in combination, the 
steps of storing each encoded portion of the mail message (data) in a separate file; decoding the 
encoded portions of the data (mail message) to produce decoded portions of the mail message; 
and scanning each of the decoded portions for a virus. Claim 21 is dependent on claim 18. 

5. As per claim 23 is objected to because of a minor mistake, but would be allowable if 
rewritten to correct the mistake, see supra paragraph 3. 

6. Claims 22, 24, 25, and 26 are allowed. 

The following is a statement of reasons for the indication of allowable subject matter: 
As per claims 22, 24, 25 and 26, the prior arts taken singly or in combination fail to teach 
equivalent means, as disclosed in the application at bar, to carry out the claimed invention. For 
example, in independent claim 22, the present invention calls for a means for determining 
whether the data contains a virus at the server. This means, as disclosed in the specification, is 
the FTP proxy server or the SMTP proxy server. The prior arts fail to teach these particular 
means or equivalent means to do the same; therefore, the examiner favors the allowance of these 
claims (id). 

Claim Rejections - 35 USC § 103 

7. The following is a quotation of 35 U.S.C. 103(a) which forms the basis for all 
obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described as set forth in 
section 102 of this title, if the differences between the subject matter sought to be patented and the prior art are 
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such that the subject matter as a whole would have been obvious at the time the invention was made to a person 
having ordinary skill in the art to which said subject matter pertains. Patentability shall not be negatived by the 
manner in which the invention was made. 

This application currently names joint inventors. In considering patentability of the 
claims under 35 U.S.C. 103(a), the examiner presumes that the subject matter of the various 
claims was commonly owned at the time any inventions covered therein were made absent any 
evidence to the contrary. Applicant is advised of the obligation under 37 CFR 1 .56 to point out 
the inventor and invention dates of each claim that was not commonly owned at the time a later 
invention was made in order for the examiner to consider the applicability of 35 U.S.C. 103(c) 
and potential 35 U.S.C. 102(f) or (g) prior art under 35 U.S.C. 103(a). 
8. Claim 1 is rejected under 35 U.S.C. 103(a) as being unpatentable over Lerche et al. 
United States Letters Patent No. 5,5 1 1,163 in view of Hile et al. United States Letters Patent No. 
5,319,776. 
As per claim 1 : 

Lerche et al. substantially teach the claimed system for detecting viruses in data transfers, 
the system comprising: 

a) a memory for storing data and routines, see the teachings by Lerche et al. 
regarding the personal computer, fig. 1. In the memory is stored a virus scan program to scan the 
transferred data for virus infection; 

b) a communications unit for receiving and sendmg data, figure 2-the Token-Ring 
adaptor. The Token-Ring adaptor has an input and an output; 
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c) a network adapter to receive information on the network. "The network adaptor is 
connected to a computer [processing unit] which together with the adaptor can perform an 
assembling and scaiming of substantially all files on the network and carry out a recognition of 
virus signatures." Emphasis added. If a virus signature is detected in a file, information is 
simultaneously provided on the transmitting stations and the receiving stations and an alarm is 
activated, whereby a finther spreading of the virus can be prevented. 

Although, Lerche et al. teach scanning for viruses in transferred data, Lerche et al. do not 
explicitly disclose selectively transferring data depending on the existence of viruses in the data 
being transmitted. 

However, Hile et al. in an analogous art teach that when a virus is detected, the virus 
detection function inform the user that a virus has been detected and gives the user the option to 
cancel the transfer-suggesting selectively transferring a file or not. 

Therefore, it would have been obvious to a person having ordinary skill in the art at the 
time the invention was made to modify the virus detection system as disclosed by Lerche et al. by 
including means and step to selectively transfer data. This modification would have been 
obvious because a person having ordinary skill in the art would have been motivated to do so, as 
suggested by Hile et al., to give the user the option to cancel the transfer of a file or data that is 
found to be infected with a virus. 
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9. Claims 5, 6-8, 13-15, 17, and 20 are rejected under 35 U.S.C. 103(a) as being 
unpatentable over Hile et al. United States Patent No. 5,319,776 in view of Lerche et al. United 
States Letters Patent No. 5,51 1,163. 
As per claim 5: 

Hile et al. substantially teach the claimed computer implemented method for detecting 
viruses in data transfers between a first computer and a second computer, see fig. 1 . The method 
comprising the step of : electronically transmitting data, col. 4, lines 1-2; determining whether 
the data contains a virus, col. 4, lines 7-8; performing a preset action on the data if the data 
contains a virus, col. 4, lines 16-22; allowing the delivery of the data if no virus is detected, see 
col. 4, lines 22-26. 

Hile et al. do not explicitly disclose that the data is sent to a destination address, nor the 
use of a server to carry out the above cited functions (id). 

However, Hile et al. teach that the invention is applicable to a network, see the abstract. 
Therefore, it would have been obvious to a person having ordinary skill in the art at the time the 
invention was made to modify the method disclosed by Hile et al. by including a destination 
address with each piece of data sent over the network. This modification would have been 
obvious because a person having ordinary skill in the art would have been motivated to do so 
since the use of destination address is well known in network routing. Moreover, Hile et al 
suggest that the disclosed invention is applicable to network. 



# 
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Furthermore, Lerche et al. in an analogous art teach the use of the server to carry out the 
function of scarming transferred data or file and detecting virus if present, see col. 1, lines 19-30; 
col. 2, lines 57-60; figure 4. Therefore, it would have also been obvious to a person having 
ordinary skill in the art at the time the invention was made to modify Hile et al.'s method by 
providing a server to carry out the functions of determining whether the data in a transferred file 
contains a virus or not. This modification would have been obvious because a person having 
ordinary skill in the art would have been motivated by the teachings and suggestions by Hile et 
al. --"Data is tested in transit between a source medium and a destination mediimi, such as 
between two computers communicating over a telecommunications link or network"; and as 
suggested by Lerche et al. that the network server can mclude virus program to perform a virus 
scan. 

As per claim 6: 

This claim is rejected under the same rationale as discussed above with regards to claim 
5. Further, Hile et al. teach storing the incoming transferred data into a temporary file, see '776, 
col. 4, lines 7(the input buffer). 

As per claim 7: 

Both references (Hile et al. And Lerche et al.) teach the step of scaiming is performed 
using a signature scanning process, see '776, col. 4, lines 6-22 and passim; also '163, col.l, Imes 
44-48. 
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As per claim 8: 

Hile et al. teach that one of the preset action after the scaiming step is to transmit or 
receive the message when no virus is detected or, for example, not allowing the data to be stored 
(transmission not complete); see col. 4, lines 16-26; col. 7, lines 3-6 and passim. 
As per claim 13: 

Hile et al. substantially teach the claimed computer implemented method for detecting 
viruses in data transfers between a first computer and a second computer, see fig. 1 . The method 
comprismg the step of : electronically transmitting data, col. 4, lines 1-2; determining whether 
the data contains a virus, col. 4, lines 7-8; performing a preset action on the data if the data 
contains a virus, col. 4, lines 16-22; allowing the delivery of the data if no virus is detected, see 
col. 4, lines 22-26. 

Hile et al. do not explicitly disclose that mail message (data) are sent to a destination 
address, nor the use of a server to carry out the above cited functions (id). 

However, Hile et al. teach that the invention is applicable to a network, see the abstract. 
Therefore, it would have been obvious to a person having ordinary skill in the art at the time the 
invention was made to modify the method disclosed by Hile et al. by including a destmation 
address with each piece of data send over the network. This modification would have been 
obvious because a person having ordinary skill in the art would have been motivated to do so 
since the use of destination address is well known in network routing. Moreover, Hile et al. 
suggest that the disclosed invention is applicable to network. 
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Furthermore, Lerche et al. in an analogous art teach the use of the server to carry out the 
function of scanning transferred data or file and detecting virus if present, see col. 1, lines 19-30; 
col. 2, lines 57-60; figure 4. Therefore, it would have also been obvious to a person having 
ordinary skill in the art at the tune the invention was made to modify Hile et al.'s method by 
providing a server to carry out the functions of determining whether the data in a transferred file 
contains a virus or not. This modification would have been obvious because a person because a 
person having ordinary skill in the art would have been motivated by the teachings and 
suggestions by Hile et al. --"Data is tested in transit between a source medium and a destination 
medium, such as between two computers communicating over a telecommunications link or 
network"; and as suggested by Lerche et al. that the network server can include virus program to 
perform a virus scan. 

As far as the mail message is concemed, Hile et al. do not explicitly disclose that the data 
is mail message, nor that the step of determining whether a mail message contains a virus is 
performed by scanning the mail message for encoded portions. However, it would have been 
obvious to a person having ordinary skill in the art at the time the invention was made to modify 
Hile et al.' s system by applying the method to data to be transferred which is "mail message". 
This modification would have been obvious because a person having ordinary skill in the art 
would have been motivated to do so in order to stop the spread of virus through the mail system 
in a network. 
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As per claim 14; 

Hile et al. teach scamiing the data to detect if a virus exist. Hile et al. do not explicitly 
disclose that the data is mail message, nor that the step of determining whether a mail message 
contains a virus is performed by scaiming the mail message for encoded portions. However, it 
would have been obvious to a person having ordinary skill in the art at the time the invention was 
made to modify Hile et al.' s system by applying the method to data to be transferred which is 
"mail message". This modification would have been obvious because a person havmg ordinary 
skill in the art would have been motivated to do so in order to stop the spread of virus through 
the mail system in a network. 

As far as scarming the encoded portion of the mail message, Lerche et al. in an analogous 
art teach that because a virus is structured like a program which is encoded in hexadecimal code, 
it can be recognized by comparing the program with program signature. Therefore, It would 
have also been obvious to a person having ordinary skill in the art a the time the invention was 
made to modify the method as disclosed by Hile et al. to scan for encoded portions of the data 
(mail message). This modification would have been obvious to a person having ordmary skill in 
the art since it is suggested by Lerche et al. — " a program comprises a nximber of commands to 
an electronic data processing system. The commands are encoded in hexadecimal codes easy to 
recognize. In this maimer it is possible to compare the program with program signatures in order 
to ensure that said program signature is in fact a portion of the complete program. A virus is in 
fact a program and can therefore be recognized in the same manner." '163, col. 3, lines 11 -24. 



• 
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As per claim 15: 

Lerche et al. teach (col. 3, lines 10-24) that the unencoded portions of the file is searched, 
see specifically col. 3, lines 20-21. 
As per claim 17: 

Hile et al, teach storing the data in a temporary file, scan the temporary file for virus, and 
determine if a virus is present or'not, see col. 4, lines 7-26 et seq. 
As per claim 20: 

Hile et al. teach that one of the preset action after the scanning step is to transmit or 
receive the data (mail message) when no virus is detected or, for example, not allowing the data 
to be stored (transmission not complete); see col. 4, lines 16-26; col. 7, lines 3-6 and passim. 



1 0. The prior art made of record and not relied upon is considered pertinent to applicant's 
disclosure. 

1. JP06350784A 

This patent pertains to a facsimile for LAN as file server- incorporated controller to scan files for 
presence of virus. 

2. EP 666671 Al 

This patent pertains to a system for communicating over a network comprising an anti virus 
checker. 



Conclusion 
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1 1 . Any inquiry concerning this communication or earlier communications from the examiner 
should be directed to Albert Decady whose telephone number is (703) 305-9595. The examiner 
can normally be reached on Tuesday to Friday from 7:30 AM to 6:00 PM. 

If attempts to reach the examiner by telephone are unsuccessfiil, the examiner's supervisor, 
Robert Beausoliel, can be reached on (703) 305-9713. The fax phone number for this Group is 
(703) 305-9724. 

Any inquiry of a general nature or relating to the status of this application or proceeding should 
be directed to the Group receptionist whose telephone number is (703) 305-3800. 




Albert Decady 



August 20, 1996 



